Getting a X.509 certificate via Let's Encrypt

Obtain a publicly trusted X.509 TLS certificate (green padlock in the browser) using acme-tiny, which talks to the Let's Encrypt certificate authority.

Parent guide: Domain and TLS Planning

Prerequisites

A valid public DNS name pointing to your server's public IP
TCP port 80 (HTTP) reachable from the internet for the ACME HTTP-01 challenge
Apache (httpd) serving the NMS Prime vhosts

1.1. Open the HTTP port

Let's Encrypt validates domain control over HTTP. Open the firewall before requesting a certificate:

firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --reload

1.2. Request a certificate

1.2.1. 1 Install acme-tiny and prepare account key

# install acme-tiny
yum install acme-tiny

# generate an account.key - if you don't have it yet - otherwise just move it into this location
openssl genrsa 4096 > /var/lib/acme/private/account.key

# set the correct permissions
chown acme:acme /var/lib/acme/private/account.key
chmod 0400 /var/lib/acme/private/account.key

1.2.2. 2 Create private key and certificate signing request (CSR)

Set your primary hostname (example: demo.nmsprime.com):

cn='demo.nmsprime.com'

# EITHER: CSR for a single hostname
openssl req -new -nodes -keyout "/etc/pki/tls/private/$cn.key" -subj "/CN=$cn" -out "/var/lib/acme/csr/$cn.csr"

# OR: CSR for multiple hostnames (e.g. $cn and www.$cn)
openssl req -new -nodes -keyout "/etc/pki/tls/private/$cn.key" -subj "/" -reqexts SAN -config <(cat /etc/pki/tls/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$cn,DNS:www.$cn")) -out "/var/lib/acme/csr/$cn.csr"

chmod 0400 "/etc/pki/tls/private/$cn.key"
chmod 0644 "/var/lib/acme/csr/$cn.csr"

1.2.3. 3 Download intermediate certificate and start renewal timer

Verify the intermediate certificate is still current against letsencrypt.org/certificates before production use.

# reload apache, and run the script
systemctl reload httpd
systemctl enable acme-tiny.timer
systemctl start acme-tiny.timer

# for a later renewal of certificates (in case you add more subdomains)
systemctl restart acme-tiny.service

# check your logs (journalctl or /var/log/messages) to see if everything went fine

1.2.4. 4 Point Apache at the new certificate

If issuance succeeded, update the NMS Prime Apache SSL paths (adjust $cn if needed):

sed -e "s|SSLCertificateFile.*|SSLCertificateFile /var/lib/acme/certs/$cn.crt|" \
    -e "s|SSLCertificateKeyFile.*|SSLCertificateKeyFile /etc/pki/tls/private/$cn.key|" \
    -i /etc/httpd/conf.d/nmsprime-{acs,admin,ccc}.conf

# to use the new certificates, reload apache
systemctl reload httpd

# remove unused self-signed certificates
rm /etc/httpd/ssl/httpd.{key,pem}
rmdir /etc/httpd/ssl

If issuance failed, inspect logs and retry: systemctl restart acme-tiny.service

1.3. Example: multi-hostname CSR (repo server)

Complete command used on the NMS repo / deployment server for several SAN names:

openssl req -new -nodes -keyout "/etc/pki/tls/private/repo.nmsprime.com.key" -subj "/" -reqexts SAN -config <(cat /etc/pki/tls/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:konferenz.nmsprime.com,DNS:repo.nmsprime.com,DNS:repo.roetzer-engineering.com,DNS:support.nmsprime.com,DNS:www.konferenz.nmsprime.com,DNS:conference.nmsprime.com,DNS:www.conference.nmsprime.com,DNS:repo.nmsprime.com")) -out "/var/lib/acme/csr/repo.nmsprime.com.csr"

1.4. Optional: change renewal check interval

By default, acme-tiny checks renewal 7 days before expiry. To renew 14 days before expiry, add a systemd drop-in (survives package updates):

mkdir -p /etc/systemd/system/acme-tiny.service.d
echo $'[Service]\nExecStart=\nExecStart=/usr/libexec/acme-tiny/sign 14' > /etc/systemd/system/acme-tiny.service.d/check-validity.conf
systemctl daemon-reload